Linux ELF Malware Generator Evades ML Detection With Semantic-Preserving Changes

Researchers at the Czech Technical University in Prague published an arXiv study describing an adversarial malware generator for Linux ELF binaries that uses a genetic-algorithm workflow and 12 modification types (including injecting benign-like strings) to preserve functionality while evading the MalConv ML detector with a reported 67.74% evasion rate and a mean confidence drop of −0.50; the paper introduces Extended Evasion Rate (EER) and confidence-shift metrics and recommends layered defenses (behavioral analysis, signatures, adversarial retraining) for Linux endpoints, containers, and cloud workloads.